SOC People, Process, and Technologies SCE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC manager is reviewing the team's incident response performance. The manager notices that the team is slow to contain incidents because analysts are unsure who has the authority to take containment actions, such as isolating a server. What should the manager do to improve the team's response time?

   • AInvest in a SOAR platform that can automatically isolate systems without human intervention.
   • BProvide all analysts with the authority to isolate any system they believe is compromised, without requiring approval.
   • CDefine and document the roles and responsibilities for containment actions, including which roles have the authority to isolate systems, and communicate this to the team.
   • DRequire the SOC manager to approve every containment action before it is taken.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A SOC analyst receives an alert from the SIEM indicating a possible data exfiltration from a database server. The analyst checks the alert and sees that the source IP is an internal server that is not normally used for outbound transfers. The analyst is unsure whether this is a true positive. According to a typical SOC escalation process, what should the analyst do?

   • AContact the database administrator to ask if the server is supposed to be sending data externally, then close the alert if the administrator says it is normal.
   • BClose the alert as a false positive because the source IP is an internal server and the alert is likely a misconfiguration.
   • CGather additional context from logs and threat intelligence, then consult the escalation procedure to determine if the alert meets the criteria for escalation to the incident response team.
   • DImmediately escalate the alert to the incident response team because any potential data exfiltration is critical.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A SOC is restructuring its team to improve incident response. The manager wants to ensure that each incident has a clear owner and that communication with stakeholders is consistent. Which organizational model would best achieve this?

   • AAssign an incident commander for each major incident who coordinates all response activities and communication.
   • BLet each analyst independently decide how to handle incidents they discover.
   • CRotate incident ownership among all analysts on each shift.
   • DHave the SOC manager personally handle every incident.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC analyst notices repeated failed login attempts against a critical application server. The analyst has verified the events are not false positives and the source IP is internal. According to the SOC's escalation procedure, which action should the analyst take next?

   • ADocument the event in the ticketing system and close it as a false positive.
   • BWait for additional failed attempts before taking any action.
   • CEscalate the incident to the incident responder and provide the gathered evidence and context.
   • DBlock the source IP at the firewall immediately to stop the attack.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is establishing a new SOC and has hired a team of analysts. The SOC manager is defining roles and responsibilities. The manager wants to ensure that during an active incident, there is a clear chain of command and that communication with executive leadership is handled appropriately. Which role assignment best supports this requirement?

   • AAssign the incident responder to handle all communication with executive leadership while the SOC manager coordinates the technical response.
   • BAllow any analyst to communicate directly with executive leadership when they discover a critical alert.
   • CHave the SOC manager personally handle all communication with executive leadership while analysts focus on technical response.
   • DDesignate an incident commander who coordinates the response effort and a separate communication lead who provides updates to executive leadership.
   Reveal Solution Discussion Select an answer first